3468e0f712bd030ba6220c89a0cbbb8adba844b43ed6ecc6676848f6e0733670

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaaffd61fec656b6b79dd3178ff950eb_JaffaCakes118.html
Size

175KB
MD5

eaaffd61fec656b6b79dd3178ff950eb
SHA1

7b6f5f37d564a629757a990b62053e236cd3538e
SHA256

3468e0f712bd030ba6220c89a0cbbb8adba844b43ed6ecc6676848f6e0733670
SHA512

aa0d6bf116521ae1e976ed7d0b777c81320bde1decac3aa130bd545dfd42965081ab5e349a07a6307400bde9be4432d1ecfbd84d6bb90ad8b3ffb104e3336eb2
SSDEEP

1536:SqtK8hd8Wu8pI8Cd8hd8dQg0H//3oS3oGNkFGYfBCJisc+aeTH+WK/Lf1/hmnVSV:SpoT3o/FPBCJi+m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
3028	msedge.exe
3028	msedge.exe
3344	identity_helper.exe
3344	identity_helper.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2948	3028	msedge.exe	82
PID 3028 wrote to memory of 2948	3028	msedge.exe	82
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 3348	3028	msedge.exe	83
PID 3028 wrote to memory of 400	3028	msedge.exe	84
PID 3028 wrote to memory of 400	3028	msedge.exe	84
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85
PID 3028 wrote to memory of 3620	3028	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaaffd61fec656b6b79dd3178ff950eb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac07e46f8,0x7ffac07e4708,0x7ffac07e4718
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,1441554979632542148,6504472528845357984,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
bfe067edf2b024c4e657e2d79ed509f9

SHA1
69ea751bd050e76ff6568ec88f4f714ee7b46ae7

SHA256
af83e58e52a248bc74556349b8fcf5bb5c5e8a1f77bfdcbe3774b1eafc88a4a6

SHA512
d79cd837791a00a42ee7463a79b405a9da78fa5c8d744be29c0991dc2b14cd31cd425de29cb50f1743ece2282a8ed50baf23f9df944c14d5269eb310a8fa0c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7cadde2a53bcda64966ccba1366d399a

SHA1
c8c022e5312686cb75631cba9226c079ed8b3c02

SHA256
af9b32965c93bd9ebcdd45deccbbd75322934fdd5c6b1aab6cb5deeb60ac05e7

SHA512
2fc36c8cbbd99cf5028ae0aca357384f0fb5f611e5fa5647128f4c993368e98d5d077727a99f6be23a5911086683687c7a8e02bfdcc5dd76536825f45d841358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
778dd5353ebdbce80ba2d4dde5396b9a

SHA1
113637c5779eb994bd7f2eba5a1c431b2e64b311

SHA256
274a3abf3fa043a2ab19bc922d11b307e8cf0164b619131ffdda399915dfd36b

SHA512
d38c2ed52f86e9a70f35f87b7d2efc16e57ce752d0fab73819a537ce71272ec8083deefef5dedf1173e7e3849cc869ff6f49af6bb89d4836a6debdf1babdc282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4eeab87cb1877c5d750f2cbbd418be32

SHA1
c94a907342f0bdfb6d7dd971a8c38ae17420075a

SHA256
673319054722d0e8e84ace85f2338f0fc9a6fde41d5747923fbdca76051be68e

SHA512
074f5470871665c884b8adf1822ee35b6bdca1ab34263658e8d7c210f4633b636e6cc428c32fef6acbcdadfcd61648615d33b139cff9e212ecd5b3b8cc967510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9fcf89710446975f1e93a41fd3e27a63

SHA1
ad98d9fe81fdd405c48914b444893c302f53dfd1

SHA256
b5427d9288ec5f6cc50964a5e28b25b7f04bcdde3f162c995089a86952f808e5

SHA512
c833573c72f209c8c738ebcce0447d258648c61646899084d7918129492531756e923b922a2906d6dea8f0bad902e98cf9fa480f700d39c3f19d5533393d2765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bc75abcf1c88803d4eb1ccd7e6b99e3e

SHA1
a00f0296c593d458c3c0a5d630a186216206a465

SHA256
af491a1300467ed917d3fc54d78855e2b0354140fa886a4860bfd3ecfe762ee6

SHA512
c4e5ad9c7c9477f01493d6729553984a46f17ccb58f3c1c19163909f7abea4b6c4a60942e9282c52225719647a0e3913a1152cbd351fbde876a27bf1e9b1c1cb

Download Submit